Acronis Cyberthreats Update, July 2025

Acronis Threat Research Unit reports attackers are using a technique called "Authenticode stuffing" to insert malicious configurations into legitimately signed ConnectWise ScreenConnect installers (and similarly tampered SonicWall NetExtender installers), preserving digital signatures while redirecting installs to attacker-controlled servers to deliver backdoors and steal credentials; the report also notes a rise in malware detections in June and recommends inspecting configuration data inside signed binaries, restricting remote access tool usage, and applying multilayered protections.